Nessus Plugin #12123

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Apache Tomcat source.jsp malformed request information disclosure

Family:

CGI abuses

Category:

infos

Copyright:

This script is Copyright (C) 2004 David Kyger

Summary:

Checks for the Tomcat source.jsp malformed request vulnerability

Version:

$Revision: 1.3 $

Cve_id:

-

Bugtraq_id:

4876

Xrefs:

-

Description:

The source.jsp file, distributed with Apache Tomcat server, will
disclose information when passed a malformed request. As a result,
information such as the web root path and directory listings could
be obtained.

Example: http://target/examples/jsp/source.jsp?? - reveals the web root
http://target/examples/jsp/source.jsp?/jsp/ - reveals the contents of the jsp directory

See also: http://www.securityfocus.com/bid/4876

Solution: Remove default files from the web server

Risk factor : Medium